How To Compare DLL Files?

Comparing DLL files is a crucial task for developers, system administrators, and security analysts to track changes, debug issues, or analyze potential threats.

A simple binary comparison is often insufficient due to compilation differences, timestamps, and other metadata. The best method depends on the nature of the DLL and the depth of the comparison needed.

Methods for comparing DLL files

1. File metadata comparison

For a quick, top-level check, comparing the file properties provides basic information and is the simplest approach. This is useful for identifying different versions of the same DLL.

How to do it:

1. Right-click on the DLL file.
2. Select Properties.
3. Navigate to the Details tab to view the file version, product version, company, and copyright information.

2. Hash value comparison

To verify that two DLLs are identical, a cryptographic hash can be used. Any change, no matter how small, will produce a completely different hash value. This is a reliable method for confirming binary equivalence.

How to do it (Windows):

1. Open PowerShell.
2. Run the Get-FileHash command for each file.
   • Get-FileHash "C:\path\to\file1.dll"
   • Get-FileHash "C:\path\to\file2.dll"
3. Compare the resulting SHA256 hashes. If they are identical, the files are identical.

3. Binary comparison

For a detailed byte-level comparison, a hex editor or binary comparison tool is required. This is useful for spotting very specific, low-level changes but can be difficult to interpret without reverse-engineering expertise.

How to do it (using a hex editor):

1. Open both DLLs in a hex editor like Hex Workshop or a similar tool.
2. Use the tool's built-in comparison feature to see the exact byte-level differences.
3. Many differences are expected, such as internal timestamps, so this method is only useful for highly technical analysis.

4. PE header and export table comparison

For a more structured comparison, examining the Portable Executable (PE) headers and the functions the DLL exports is a valuable technique. The DUMPBIN utility, included with Visual Studio, is a standard tool for this.

How to do it (using DUMPBIN):

1. Open a Visual Studio Command Prompt.
2. Dump the header information from each DLL to a text file:
   • dumpbin /headers "C:\path\to\file1.dll" > file1_headers.txt
   • dumpbin /headers "C:\path\to\file2.dll" > file2_headers.txt
3. Dump the exported functions:
   • dumpbin /exports "C:\path\to\file1.dll" > file1_exports.txt
   • dumpbin /exports "C:\path\to\file2.dll" > file2_exports.txt
4. Use a text comparison tool like Windiff or a code editor to compare the resulting text files. This reveals changes in the function names, addresses, and other header details.

5. Decompilation and source code comparison

For managed DLLs (such as those compiled for .NET), decompilation provides the most human-readable and useful comparison. This converts the compiled binary back into a higher-level language, allowing for a line-by-line comparison of the code logic.

How to do it (using dotPeek and a file comparison tool):

1. Use a free decompiler like JetBrains' dotPeek to open both DLLs.
2. For each DLL, use dotPeek's Export to Project feature to generate a folder of source code files.
3. Use a folder comparison tool like WinMerge or Beyond Compare to compare the two exported project folders.
4. You will need to configure the diff tool to ignore automatically generated comments (e.g., // MVID: {some guid here}) for a cleaner comparison.

6. Specialized assembly comparison tools

Several specialized tools are designed for comparing assemblies, offering advanced features beyond simple decompilation and diffing.

• JetBrains' dotPeek and ReSharper: These tools have an integrated Assembly Diff feature that shows changes in classes, methods, and public APIs. It can hide identical items, allowing you to focus only on the differences.
• Beyond Compare (commercial): With custom configurations, this versatile tool can integrate with decompilers like ildasm to automatically decompile and compare the source of two assemblies.

7. Reverse-engineering tools

For low-level, in-depth analysis, especially for unmanaged code, reverse-engineering tools are the most powerful option.

• IDA Pro (commercial): A powerful disassembler that, with the commercial Bindiff plugin, can perform advanced binary diffing to highlight structural and functional changes in binaries.
• Ghidra (free): The NSA's open-source reverse-engineering suite, which includes robust binary diffing capabilities for detailed analysis of patched DLLs.